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This listing of daims will replace all prior versions^ and listings, of daims In the application. 
Listing of Claims: 

1. (cumently amended) A method of enw recovery in a lodcstep computer 
proce^ng s^m, the ^^tem comprising a primary processor and a secondary processor and 
a bus-bndge to a network, comprising the steps of: 

operating the primary and secondary processors in lockstep; 
reoiving an error notification resulting ftxxn an error in either the primary prxxessor or 
ttie secondary processor; ' *^ wi 

determining if the error is a recoverable error; and 
If the error is a recoverable error, then 

saving the state of either the primary a the secondary processor to a memory; 

and dlsabtino me hus hri^P to the network- 

resetting and restarting the primary and secondary prxjcessors using the saved 
stat e; and 

if the enxy is determined tn hP a non-necm/Pra ^e entir. thPn 

disabling thg bus bridge to the networic befhrP rta t a aMTUotinn r^miltina fmm thP 
error can DroiM n ate onto iheriPtw^ yf; w.>vhmv,, ,mwMi.q ^^n Tnff 

2. (original) The method of claim 1 furtJier comprising the steps of 

detecting a divergence in the operation of ttie primary and secondary processors before 
receiving the error notification; ' ^ waore 

waiting for a predetermined time after detecting the divergent^; and 
^ ■ before the expiry of the predetermined time and If the 

enor is determined to be a neooverable enw, then treating the enw as a recoverable error. 

3. (curently amended) 7710 method of cla i m 2 A method nf Prr nr r^r.^ i» . 
Ipckstep cpmputgr processing system, the system m m r)risinQ a m-mT^^^ \ — 
secondary orocessor ;,nri r^ hrirtg ^ ^ a \s7>^^ ^ r^^mp ^ino tt^ "^^IJ^ ^ " ^ 

operatno the primary and secondary pr ncessors in lrylt«^ f>p; 

pgceivinq an error notrficaUon resultmo from a n en-or in eithPr the ririmarv nmr»»co^ nr 
the seconda ry processor; " ' ^ w^vrnv^ vr 

CtetermininQ if the »ror is a rP coverahle qfn y ; 
if the emor is a rPTToverable Pn-ty, ^on 

savlnq the gtgte of either the primary or t h e secondary p r^ym^ ^? ft m^mfTTY; 

r^gtjpq and rRf^ti^rtinq the primary and semnriaty p rocessors; ucinf^ the saved state- 
th^ ^ notification is received afta- the expir^^f the predeteTmlnedtime, 

then treabng the enrjr as a non-recoverable enxir. 

4. (original) The method of daim 1 wherein a non-recoverable error on the seoondaw 
processor is treated as a recoverable error. aeoonoary 
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5. (curTBrtly amended) The method of dalm [WLLfurther comprising the steps | 
if the error is determined to be a non-recoverable errw, then 

6. (original) TTie medKxl of dalm 1 wherein a hardware error that results in the loss 
of a resource that is currently not being used b/tte 

recoveiBDle error, 

^v^thZ; ^ ""^^ ^"^^ ^ *e error notification reports an error 

^""^ ^^"^ ^ notification includes an identifier that 
an be used to detemiine whether the hardware resource is critical or non-criBcal. 

hardwareJS^i^s ^-^ZT """""^ ' ""'"^ ^''^^^^ '^^ 

r^^^^Tl wJllL'^®^*^*^'^'"' ^ hardware resource is retried after 

processor restart to determine if the emor in the hardware resource can be cured bv a 
processor reset. ucwucuuyci 

10. (original) The method of daim 2 wherein the system indudes a single main 
memory, the step of detecting divergence comprises the steps of: 

comparing memory commands generated by the primary jjrocessor with memorv 
commands generated by the secondary processor^ 7 h w.«sur w«n memory 

©<ecuting only the memory commands generated by the primary processor; and 

r^S^'S^^J^!^'^ "^^"^ ^ '"^o^ commands issued by the primaiy 
processor diffier from the memory commands issued by the secondary processor 

11. (original) The method of claim l further comprising the steps of: 

bridge ^S^^"^ ^ °^ *^ "^"^"^ ^ the 

determl^tol«1^^,e'°eX?r."^^ """^^^ ""'^ ^« «^ ^ P^^V been 

12. (originaO The mediod of daim 2 wherein the divergence detection is conducted bv 
SSl.""'^'* "'^"^ ^"""^ PrimSy^nd SSSa!?^ ^ 

13. (Original) The method of daim 12 wherein the unique signatures are oenerateri hv 
applying an algorithm to stete information for the primary and siSylJSSII 

14. (originaO The method of daim 1 further comprising the steps of- 
conducting first and second flushes of cadie memory of either the primary or the 

secondary processor. yv 
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15. (original) The method of daim 1 ftjrther comprising the steps of: 
conducting a high-speed reset and restart of the lyldge to the network. 

16. (original) The mahod of dalm 15 wherein the bridge to the networic has a custom 
high-speed reset and restart procedure. 

17. (original) The method of dalm 1 further comprising the steps of: 
setting a watchdog timer; and 

treating the error as a non-recoverable emor If the watchdog timer expires before the 
resetting of the primary and secondary processors. 

18. (original) The method of daim 17 wherein the step of treating the error as a non- 
recoverable error comprises the step of: 

conducting a hard-reset of the lockst^ computer processing sysb^. 

19. (original) The method of claim 1 wherein the step of restarting the primary arxl 
secondary processors using the saved state further Indudes the st^ of: 

running the bridge to the networic from a main memory until a bridge local memory has 
been initialized. 

20. (original) The method of daim 1 wherein the tockstep computer processing system 
is being utilized by a networic resource, the network resource: 

sending a data message to the lodcstep computer processing system, the data message 
being lost due to the res^ng and restarting cjf the primary and secondary processors; 

sending a first inquiry message to the tockstep romputer processing system after a first 
tinr>eout period, the first inquiry message being lost due to the lockstep computer procesang 
system being unavailable; and 

sending a second inquiry m^sage after a second timeout period; 

wherein the sum of the first and second timeout pericxis is selected to be greater than 
an expected recovery time for the icxkstep computer processing system* 

21. (currently amended) The svstem -method of claim 20 wheren the network | 
resource sends out no retries of the data message until a response is received to an inquiry 
messaga 

22. (cun-ently amended) A computer system comprising: 

a primary processor and a secondary processor being configured to operate in lockstep^ 
and a bus bridge to a networic: and 

an error-handling module to receive an error notification resulting from an error in either 
the primary processor or the secondary processor, to determine if the enor is a recoverable 
errorij-aBdr I 

if the error is a recoverable error, then to initiate saving the state of either the primary 
or the secondary processor to a memor y and disabiinQ the bus bridge to the n^oric and to 
reset and restart the primary and secondary processors using the saved stat e; and 
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if the error is determ ined tp be a non-recoverable error, ttien the system is oonfiQured to 
disable the bus faridoe to the network before data cnmip^^n rg^^i i tttng from the error can 
oropaaate onto the network, 

23. (original) The system of claim 22 wherein the entr-handling module is further 
configured to receive a notification of a divergence in the ope-atlon of the primary and 
secondary processors before neoelving the emcN^ notifkstion, the error-handling module being 
further configured to 

wait for a predet^-mined time after receiving the notification of divergence; and 
if the error notification is received before the expiry of the pred^mined time and if the 
error is determined to be a recoverable error, to treat the error as a recoverable error, 

24. (currently amended) The system of doim 23 A computer system comprisinQ: 

a prlman/ processor and a secondar/ processor betno configured to operate in locksteo: 
and 

an en-or-handlino module to receive an error notification resu ltino from an error in either 
the Primary orocessor or the secondary processor to d etermine If the error is a recoverable 
error and> If the error is a recoverabfe error, then to initiate saving the state of either the 
primary or the secondary processor to a memoiv and to reset and restart the primary and 
ggwndgry procggsors using thg saved state ; 

wherein, if the error notification is received after the expiry of the predetermined time, 
then the error-handling module treats the error as a non-recoverable error. 

25. (original) The system of claim 22 wherein a non-reooveraUe error on the secondary 
processor is treated as a recoverable error, 

26. (cumentiy amended) The system of daim [[2fa-]]2±further cwnprising a bridge | 
to a network, wherein 

if the error is determined to be a non-recoverable error, then the system is configured to 
disable the bridge to the network before data corruptk^n resulting from the error can 
propagate onto the network. 

27. (original) The system of claim 22 wherein, in use, a hardware error that results in a 
loss of a resource tiiat is xkH bting used by the primary processor Is treated as a recoverable 
error. 

2a (original) The system of claim 22 wherein. In use, the error noBfication reports an 
error occurring in a hardware resource, and wherein the error notification includes an identifier 
tiiat can be used to determine lArfiether the hardware resource is critkal or non-criticaL 

29. (original) The system of daim 28 wheren the systOT is fijrther configured to 
disable the hardware resource If the hardware rescurce is non-aitical, 

30. (original) The system of claim 28 wherein the system is further configured to retry 
the hardware resource after processor restart to determine if the errw in the hardware resource 
can be cured by a processor reset. 
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31. (original) TTie system of claim 23 further comprising a main memory, the system 
being configured to detect divergence by: 

comparing memory commands generated by the primary pnocessor with memory 

commands generated by the secondary processor; 

executing only the memory commands generated by the primary processor; and 
signaling a divergence detection if the memory commands issued by the primary 

processor differ from the memory commands issued by the secondary processor. 

32. (Original) The system of claim 22 further comprising: 

a bridge to an external network, the computer system being configured to: 

detect a divergence in the operation <rf the primary and secondary processors at the 

bridge to the network; and 

shut off the bridge to the network immediately unless the error has previously been 

determined to be a recoverable error. 

33. (ori^nal) The system of dalm 23 wherein the error-handling module does 
divergence d^ection by comparing unique signatures of processor state received from the 
primary and secondary processors. 

34. (original) The s\«tem of daim [[33]] 33.wherein the unique signatures are 
gen^ted by applying an algorithm to state information for the primary and secondary 
processors. • 

35. (original) The system of daim 22 wherein the reset and restart of the primary and 
secondary processors indudes the step of: 

conducting first and second flush« of cache memory of either the primary or the 
secondary processor. 

36. (original) The system of claim 32 wherein the bridge is configured to conduct a 
high-speed reset and restart during the reset and restart of the primary and secondary 
processors. 

37. (original) The system of dalm 36 wherein the bridge to the network has a custom 
high-speed reset and restart procedure. 

38. (original) The system of daim 22 further comprising a watchdog timer, the system 
treating the error as a non-recoverable emor if the watchdog timer expires during the reset and 
restart of the primary and secondary processors. 

39. (original) The system of daim 38 wherein the system conducts a hard-reset of the 
lockstep computer processing system upon expiry of the watchdog timer. 

40. (original) The system of dalm 22 further comprising: 
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a bridge to an external network, the computer systsem being conflgired run the bridge 
to the network from a main memor/ until a bridge local memoiy has been initialized upon the 
reset and restart of the primary and secondary processors. 

41. (original) The system of claim 22 further comprising a network bridge associated 
with the primary and secondary processor and a networic resource for utiliang the primary and 
secondary processor over a networi<, the network resource being configured to: 

send a data message to the network bndge over the network, and, when the data 
message is lost due to the resetting and restarting of the primary and secondary prooesrors, to: 

send a first inqiiry message to the networic bridge after a first timeout period, and, 
when the first inquiry message is lost, to: 

send a second inquiry message after a second Hmeout period; 

wherein the sum of the first and second timeout p^ods Is selected to be great©- than 
an expected recovery time for the primary and secondary processors. 

42. (ori^nal) The system of claim 41 wherein the network resource sends out no 
rebies of the data message until a response is reo^ved to an inquiry message. 
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